tests existing pcapng files about python-pcapng HOT 6 CLOSED

Yup.. that was my intention as well.
Probably the best thing would be testing the library against a collection of:

• hand-crafted capure files, following the spec
• output capture files from different capture conditions (eg. capture from different interfaces / resumes from machines with different endianness / ...)
• ouput capture files from different implementations of the "writer" library, especially in case we should find any possible inconsistency amongst implementations, etc..

My idea was to create a separate repository with those test files (to avoid cluttering the main repo) and then pull the files in the testing environment (eg. using an env variable to reference the path of the local copy).

Contributions are very welcome ;)

from python-pcapng.

An issue is that the files I've added for testing cannot be open by wireshark, does anyone can check that ?

from python-pcapng.

Strange, but I'm not that surprised: it looks there might be some problems with determining endianness (that's one thing I don't like in the standard, btw.. they should have just used "network standard" endianness, i.e. big endian, instead of allowing mixing..):

The capture file appears to be damaged or corrupt.
(pcapng_read_block: total block lengths (first 139 and second 4077998952) don't match)

and maybe even incomplete support for the various "packet" (binary packed data, not actually packets) types.

For what I see, most libraries / tools tend to have their own implementation quirks, that's one reason why I started writing a library from scratch, instead of just wrapping a C library..

from python-pcapng.

While writing tests I found out that test006 incorrectly reports block size to be 1 byte shorter (and not aligned on a 32bit boundary). I'm not sure whether a library is expected to fail in that case, or try fixing the size (thus returning block payload aligned correctly, but possibly with extra data..)

from python-pcapng.

@kartoch do you have any follow-up on this? did you find any other interesting pcapng file to test against?

otherwise, I'm going to close this

from python-pcapng.

@rshk you can close it, no news on my side.

from python-pcapng.